This invention relates to a disaster recovery for a computer system performed by utilizing remote copy.
The data storage market has seen an increasing demand for a so-called disaster recovery system for preventing loss of data even when a storage system storing mass data is destroyed in a disaster or the like. In order to satisfy such a demand, there is provided a computer system that utilizes a remote copy technique for backing up data. This computer system allows the same data to be stored in storage systems located in two different sites that are sufficiently distant from each other. When data is updated in one storage system, the update is reflected on the other storage system. Thus, the two storage systems maintain data consistency.
In addition, JP 2003-122509 A discloses a computer system in which storage systems are located in three different sites that are sufficiently distant from one other in order to enhance the safety of data stored therein. In this computer system, synchronous remote copy is used to maintain the data consistency between a first storage system used for normal tasks and a second storage system located in the distance. Meanwhile, asynchronous remote copy is used to maintain the data consistency between the first storage system and a third storage system located in the distance.
When the first storage system can no longer be used for tasks because of a failure due to a disaster, the second storage system takes over the tasks of the first storage system. When even the second storage system cannot be used, the third storage system takes over the tasks of the first storage system. As a result, the loss of data can be prevented even when serious disaster occurs.
During normal operation of the computer system including the storage systems located in the three different sites, the data cannot be copied between the second storage system and the third storage system. Thus, data consistency cannot be guaranteed between the second storage system and the third storage system. Therefore, when a failure occurs in the second storage system even after the second storage system takes over the tasks of the first storage system, the third storage system cannot take over the tasks of the second storage system.
In view of this, the data consistency is maintained between the second storage system and the third storage system before the second storage system that has taken over the tasks of the first storage system begins operation. After the second storage system begins operation, the remote copy is used to reflect the update of data of the second storage system on the third storage system. As a result, when a failure occurs in the second storage system, the third storage system can take over the tasks of the second storage system.